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DISK DRIVE ODOMETER 

BACKGROUND OF THE INVENTION 

The present invention relates to a device associated with a hard disk drive for 
improving data security by keeping a history of reads and writes to and from the 
drive. 

There is a need for purposes of data security to track the reading and writing 
activity that has occurred for a given hard disk drive or other storage device. For 
example, if a drive has been stolen there is a need after the drive has been recovered 
to know whether the data on the drive was accessed by the thief Further, there is a 
need to monitor read and write activity on a routine basis, to determine whether any 
unauthorized activity (such as theft, destruction or modification of data) has taken 
place. 

Circuits are known in the data communications field, for example a circuit on 
a known Ethernet card, for tracking a number of bytes sent and received over a 
network. Such circuits may be used for purposes of billing and for enforcing 
compliance with licensing limitations. In view of this state of the art, those skilled in 
the pertinent art will appreciate that circuits are available and/or can be developed for 
carrying out the novel purposes and functions described herein. 

SUMMARY OF THE INVENTION 

To address these needs, the invention provides a disk odometer which 
comprises a circuit associated with a given disk drive, or any compatible storage 
device, for tracking the number of bytes that have been read to or from the disk over 
a given period of time. 
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In this context, the term "disk" should be understood to include any mass 
storage device that is capable of having a device according to this invention built into 
or added onto it. This includes any fixed or removable disk, but also a flash memory 
card or any other device that can support an attached circuit for carrying out the 
functions described herein. 

Conventionally, disk circuitry has a read/write buffer which exchanges data 
with the disk/bus interface. According to an embodiment of the invention, the 
odometer device may be an additional circuit, namely a counter that is automatically 
incremented upon each data exchange. For simplicity, the counter may count up 
only. The counter may be incremented for every disk access, whether read or write. 
Alternatively, there may be two counters, one for reads and one for writes. 

Advantageously, but not necessarily, the counter is never decremented under 
any conditions, to avoid the risk that an unauthorized disk access could be concealed 
by manipulating operating conditions of the disk to reduce the counter reading to an 
original value. 

Likewise, the counter advantageously, but not necessarily, does not reset 
upon overflow, again to avoid the possibility that an unauthorized disk access could 
be concealed by a reset of the counter. 

The memory in the disk odometer is advantageously a read-only memory, and 
is accessible at only a single interface and via pins, for example, which permit 
readout only, in order to prevent or discourage tampering with the odometer. 

Optionally, after being checked, the odometer can be either manually or 
automatically reset by an authorized person to zero or another value. 

Optionally, sector, cylinder, and/or head information pertaining to the reads 
and writes can be stored as well. 

According to another embodiment of the invention, the odometer may store 
time information and indicate the date and time at which the disk accesses occurred. 
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Other features and advantages of the present invention will become apparent 
from the following description of the invention which refers to the accompanying 
drawings. 

BRIEF DESCRIPTION OF THE DRAWINGfS) 

The Figure is a schematic block diagram showing one embodiment of the 
invention. 

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION 

The Figure shows one embodiment of the invention. Data pass in both 
directions between the system bus and the disk drive via the disk/bus interface. The 
disk/bus interface is built inseparably into the physical disk drive. Included in the 
disk/bus interface is a counter which increments for each byte of data which passes 
into or out of the disk drive. 

A reading circuit is provided on the motherboard of the computer for 
accessing the current value stored in the counter. 

A routine is included in the operating system (OS) software for displaying the 
counter value. Further, even when there is no suspicion of a security breach, the OS 
can implement regular readings of the counter according to a predetermined 
schedule, and/or implement a locking function. According to the locking function, 
the counter value is constantly or periodically monitored and an alarm is issued if its 
value changes, which would indicate an unauthorized disk access. 

Although the present invention has been described in relation to particular 
embodiments thereof, many other variations and modifications and other uses will 
become apparent to those skilled in the art. It is preferred, therefore, that the present 
invention be limited not by the specific disclosure herein, but only by the appended 
claims. 
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